GB35114---聊聊SM2签名格式
公司原计划是年后让我直接去公安一所过35114的认证，但是突发疫情，导致上班时间一推再推，最后也只能远程用升级包的方式给检测员进行认证。
前几次的尝试，服务器一直回复401，让我百思不得其解，甚至开始让我产生对算法的怀疑。现在回过头来看，其实SM2签名格式不理解是导致一直验签失败的主要原因。
按照国密的规范，SM2签名结果r||s长度应该是(r:32字节)+(s:32字节)64字节，就算加个04头字节，也是65个字节。但是，我参考网上有限的资料发现sign1签名MEQCIC24h6tnaKcOnxNZe93rtLFrKEqM9R3yG8/Ba2+tyE+3AiBTG46yfxJziYDlaH1WZjrCfRloIuMnfx5oyEVuwgbV0A==长度为96字节，这一看就是base64加密数据，源签名长度96/4*3=72字节。
SM2签名结果长度为64字节，为什么出来的是72字节？我咨询过好几个过35114的博客主，回复都是，我们是硬加密。/(ㄒoㄒ)/~~
其实，SM2签名结果数据是要经过asn.1(der格式)编码的。
编码结果长度在70-72变化。
我们来看openssl内通过
int i2d_ECDSA_SIG(const ECDSA_SIG *sig, unsigned char **pp);
ECDSA_SIG *d2i_ECDSA_SIG(ECDSA_SIG **sig, const unsigned char **pp, long len);
函数来进行对ECDSA_SIG格式与asn.1编码相互转化的。
最后附上注册数据包
REGISTER sip:[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.1.198:5060;rport;branch=z9hG4bKPjxp5SsGzh.j3U8MYfe.5RmOV-H483DWnt
Max-Forwards: 70
From: ;tag=vRq11dVmXG7i5AqD26oyX.mQM-tjGsLT
To:
Call-ID: 151959520
CSeq: 1 REGISTER
Expires: 3600
Authorization: Capability algorithm="A:SM2;H:SM3;S:SM4/OFB/PKCS5;SI:SM3-SM2",keyversion="1970-8-16T19:54:35"
Contact:
Content-Length: 0
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 192.168.1.198:5060;rport=5060;branch=z9hG4bKPjxp5SsGzh.j3U8MYfe.5RmOV-H483DWnt
From: ;tag=vRq11dVmXG7i5AqD26oyX.mQM-tjGsLT
To: ;tag=894209716
Call-ID: 151959520
CSeq: 1 REGISTER
User-Agent: eXosip/4.1.0
Expires: 3600
Date: 2020-03-09T15:24:47.054
WWW-Authenticate: Bidirection algorithm="A:SM2;H:SM3;S:SM4/OFB/PKCS5;SI:SM3-SM2", random1="iqxeFEd+zXOwlgxERVI6RQ=="
Content-Length: 0
REGISTER sip:[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.1.198:5060;rport;branch=z9hG4bKPj4BWBr8Ul2sCtikHC6SUB4UqMzghmUY5q
Max-Forwards: 70
From: ;tag=vRq11dVmXG7i5AqD26oyX.mQM-tjGsLT
To: ;tag=894209716
Call-ID: 151959520
CSeq: 2 REGISTER
Contact:
Expires: 3600
Authorization: Bidirection random1="iqxeFEd+zXOwlgxERVI6RQ==",random2="skFXTJAlP98cbUkeeCSx7w==",serverid="34020000002000000001",sign1="MEQCIC24h6tnaKcOnxNZe93rtLFrKEqM9R3yG8/Ba2+tyE+3AiBTG46yfxJziYDlaH1WZjrCfRloIuMnfx5oyEVuwgbV0A==",algorithm="A:SM2;H:SM3;S:SM4/OFB/PKCS5;SI:SM3-SM2"
Content-Length: 0
SIP/2.0 200 OK
Via: SIP/2.0/UDP 192.168.1.198:5060;rport=5060;branch=z9hG4bKPj4BWBr8Ul2sCtikHC6SUB4UqMzghmUY5q
From: ;tag=vRq11dVmXG7i5AqD26oyX.mQM-tjGsLT
To: ;tag=894209716
Call-ID: 151959520
CSeq: 2 REGISTER
User-Agent: eXosip/4.1.0
Expires: 3600
Date: 2020-03-09T15:24:47.267
SecurityInfo: Bidirection algorithm="A:SM2;H:SM3;S:SM4/OFB/PKCS5;SI:SM3-SM2",random1="iqxeFEd+zXOwlgxERVI6RQ==",random2="skFXTJAlP98cbUkeeCSx7w==",deviceid="34020000001320000001",cryptkey="MHoCIQC8G0MLIbZfce7F2voDAN+FCpJf/oY/2SRPCJRos1i4NQIhAJq2pNkZBF4Zrvt9Pq9UaWstOYRANhBZ0PHj5XkkzxFRBCCrEsniIp5VqgY1b9wHspo2kmjZFhvN7ctrN5gex9SyUQQQeoRLl5cPoCPf0Z5oNeflGw==",sign2="MEUCIG3sSFbbCXelzhNxrTsZsHYdJv2Oy0WHHKTJpksxJVvxAiEA6ADKoX970RmZS+5NTaMiUsg0S4H3uaqO+Jy1tKvSIaQ="
Content-Length: 0
有错误请留言，谢谢
---bob 2020/3/17